
<!DOCTYPE HTML>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
    <title>WTForms Documentation</title>
    <link rel="stylesheet" href="_static/main.css" type="text/css">
    <link rel="stylesheet" href="_static/docstyles.css" type="text/css">
    <link rel="stylesheet" href="_static/print.css" type="text/css" media="print">
    <link rel="stylesheet" href="_static/pygments.css" type="text/css">
    <script type="text/javascript">
      var DOCUMENTATION_OPTIONS = {
        URL_ROOT:   '#',
        VERSION:    '1.0.4'
      };
    </script>
    <script type="text/javascript" src="_static/jquery.js"></script>
    <script type="text/javascript" src="_static/searchtools.js"></script>
    <script type="text/javascript" src="_static/doctools.js"></script>
    <link rel="contents" title="Global table of contents" href="contents.html">
    <link rel="index" title="Global index" href="genindex.html">
    <link rel="search" title="Search" href="search.html">
    <link rel="top" title="WTForms 1.0.4 documentation" href="index.html">
    <link rel="next" title="FAQ" href="faq.html">
    <link rel="prev" title="Widgets" href="widgets.html">
    
  </head>
  <body>
    <div id="body">
      <div id="header">
        <h1 id="logo"><a href="index.html"
          title="back to the documentation overview"><img src="_static/wtforms.png" alt="WTForms" /></a></h1>
        <ul id="menu">
          <li><a href="http://wtforms.simplecodes.com/">Website</li>
          <li><a href="index.html">Documentation</a></li>
          <li><a href="faq.html">FAQ</a></li>
          <li><a href="http://groups.google.com/group/wtforms/">Mailing List</a></li>
          <li><a href="http://bitbucket.org/simplecodes/wtforms/">Code</a></li>
        </ul>
      </div>
      <div id="content">
        <div id="toc">
          <h3>Table Of Contents</h3>
          <div class="inner"><ul>
<li><a class="reference internal" href="#">Extensions</a><ul>
<li><a class="reference internal" href="#module-wtforms.ext.appengine">Appengine</a><ul>
<li><a class="reference internal" href="#module-wtforms.ext.appengine.db">Model Forms</a></li>
<li><a class="reference internal" href="#module-wtforms.ext.appengine.fields">Datastore-backed Fields</a></li>
<li><a class="reference internal" href="#ndb">NDB</a></li>
</ul>
</li>
<li><a class="reference internal" href="#module-wtforms.ext.dateutil.fields">Dateutil</a></li>
<li><a class="reference internal" href="#module-wtforms.ext.django">Django</a><ul>
<li><a class="reference internal" href="#module-wtforms.ext.django.templatetags.wtforms">Templatetags</a></li>
<li><a class="reference internal" href="#id2">Model forms</a></li>
<li><a class="reference internal" href="#module-wtforms.ext.django.fields">ORM-backed fields</a></li>
</ul>
</li>
<li><a class="reference internal" href="#module-wtforms.ext.sqlalchemy">SQLAlchemy</a><ul>
<li><a class="reference internal" href="#id3">ORM-backed fields</a></li>
</ul>
</li>
<li><a class="reference internal" href="#module-wtforms.ext.csrf">CSRF</a><ul>
<li><a class="reference internal" href="#creating-your-own-csrf-implementation">Creating your own CSRF implementation</a></li>
<li><a class="reference internal" href="#module-wtforms.ext.csrf.session">Session-based CSRF implementation</a></li>
</ul>
</li>
</ul>
</li>
</ul>
</div>
        </div>
        
  <div class="section" id="extensions">
<span id="id1"></span><h1>Extensions<a class="headerlink" href="#extensions" title="Permalink to this headline">¶</a></h1>
<span class="target" id="module-wtforms.ext"></span><p>WTForms ships with a number of extensions that make it easier to work with
other frameworks and libraries, such as Django.</p>
<div class="section" id="module-wtforms.ext.appengine">
<span id="appengine"></span><h2>Appengine<a class="headerlink" href="#module-wtforms.ext.appengine" title="Permalink to this headline">¶</a></h2>
<p>WTForms includes support for AppEngine fields as well as auto-form
generation from models.</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">WTForms supports both <cite>appengine.ext.db</cite> and <cite>appengine.ext.ndb</cite> style models now,
and there is some overlap between them. For the near future, we will continue
to support both, but at some point WTForms will go to only supporting AppEngine
for python 2.7 and drop support for ext.db models as well.</p>
</div>
<div class="section" id="module-wtforms.ext.appengine.db">
<span id="model-forms"></span><h3>Model Forms<a class="headerlink" href="#module-wtforms.ext.appengine.db" title="Permalink to this headline">¶</a></h3>
<p>See the module docstring for examples on how to use <a class="reference internal" href="#wtforms.ext.appengine.db.model_form" title="wtforms.ext.appengine.db.model_form"><tt class="xref py py-func docutils literal"><span class="pre">model_form()</span></tt></a>.</p>
<dl class="function">
<dt id="wtforms.ext.appengine.db.model_form">
<tt class="descclassname">wtforms.ext.appengine.db.</tt><tt class="descname">model_form</tt><big>(</big><em>model</em>, <em>base_class=Form</em>, <em>only=None</em>, <em>exclude=None</em>, <em>field_args=None</em>, <em>converter=None</em><big>)</big><a class="headerlink" href="#wtforms.ext.appengine.db.model_form" title="Permalink to this definition">¶</a></dt>
<dd><p>Creates and returns a dynamic <tt class="docutils literal"><span class="pre">wtforms.Form</span></tt> class for a given
<tt class="docutils literal"><span class="pre">db.Model</span></tt> class. The form class can be used as it is or serve as a base
for extended form classes, which can then mix non-model related fields,
subforms with other model forms, among other possibilities.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><ul class="first last simple">
<li><strong>model</strong> &#8211; The <tt class="docutils literal"><span class="pre">db.Model</span></tt> class to generate a form for.</li>
<li><strong>base_class</strong> &#8211; Base form class to extend from. Must be a <tt class="docutils literal"><span class="pre">wtforms.Form</span></tt> subclass.</li>
<li><strong>only</strong> &#8211; An optional iterable with the property names that should be included in
the form. Only these properties will have fields.</li>
<li><strong>exclude</strong> &#8211; An optional iterable with the property names that should be excluded
from the form. All other properties will have fields.</li>
<li><strong>field_args</strong> &#8211; An optional dictionary of field names mapping to keyword arguments
used to construct each field object.</li>
<li><strong>converter</strong> &#8211; A converter to generate the fields based on the model properties. If
not set, <tt class="docutils literal"><span class="pre">ModelConverter</span></tt> is used.</li>
</ul>
</td>
</tr>
</tbody>
</table>
</dd></dl>

</div>
<div class="section" id="module-wtforms.ext.appengine.fields">
<span id="datastore-backed-fields"></span><h3>Datastore-backed Fields<a class="headerlink" href="#module-wtforms.ext.appengine.fields" title="Permalink to this headline">¶</a></h3>
<dl class="class">
<dt id="wtforms.ext.appengine.fields.ReferencePropertyField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.appengine.fields.</tt><tt class="descname">ReferencePropertyField</tt><big>(</big><em>default field arguments</em>, <em>reference_class=None</em>, <em>get_label=None</em>, <em>allow_blank=False</em>, <em>blank_text=''</em><big>)</big><a class="headerlink" href="#wtforms.ext.appengine.fields.ReferencePropertyField" title="Permalink to this definition">¶</a></dt>
<dd><p>A field for <tt class="docutils literal"><span class="pre">db.ReferenceProperty</span></tt>. The list items are rendered in a
select.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><ul class="first last simple">
<li><strong>reference_class</strong> &#8211; A db.Model class which will be used to generate the default query
to make the list of items. If this is not specified, The <cite>query</cite>
property must be overridden before validation.</li>
<li><strong>get_label</strong> &#8211; If a string, use this attribute on the model class as the label
associated with each option. If a one-argument callable, this callable
will be passed model instance and expected to return the label text.
Otherwise, the model object&#8217;s <cite>__str__</cite> or <cite>__unicode__</cite> will be used.</li>
<li><strong>allow_blank</strong> &#8211; If set to true, a blank choice will be added to the top of the list
to allow <cite>None</cite> to be chosen.</li>
<li><strong>blank_text</strong> &#8211; Use this to override the default blank option&#8217;s label.</li>
</ul>
</td>
</tr>
</tbody>
</table>
</dd></dl>

<dl class="class">
<dt id="wtforms.ext.appengine.fields.StringListPropertyField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.appengine.fields.</tt><tt class="descname">StringListPropertyField</tt><big>(</big><em>default field arguments</em><big>)</big><a class="headerlink" href="#wtforms.ext.appengine.fields.StringListPropertyField" title="Permalink to this definition">¶</a></dt>
<dd><p>A field for <tt class="docutils literal"><span class="pre">db.StringListProperty</span></tt>. The list items are rendered in a
textarea.</p>
</dd></dl>

<dl class="class">
<dt id="wtforms.ext.appengine.fields.GeoPtPropertyField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.appengine.fields.</tt><tt class="descname">GeoPtPropertyField</tt><big>(</big><em>default field arguments</em><big>)</big><a class="headerlink" href="#wtforms.ext.appengine.fields.GeoPtPropertyField" title="Permalink to this definition">¶</a></dt>
<dd></dd></dl>

</div>
<div class="section" id="ndb">
<h3>NDB<a class="headerlink" href="#ndb" title="Permalink to this headline">¶</a></h3>
<p>WTForms now includes support for NDB models and can support mapping the
relationship fields as well as generating forms from models.</p>
<dl class="class">
<dt id="wtforms.ext.appengine.fields.KeyPropertyField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.appengine.fields.</tt><tt class="descname">KeyPropertyField</tt><big>(</big><em>default field arguments</em>, <em>reference_class=None</em>, <em>get_label=None</em>, <em>allow_blank=False</em>, <em>blank_text=''</em><big>)</big><a class="headerlink" href="#wtforms.ext.appengine.fields.KeyPropertyField" title="Permalink to this definition">¶</a></dt>
<dd><p>A field for <tt class="docutils literal"><span class="pre">ndb.KeyProperty</span></tt>. The list items are rendered in a select.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><ul class="first last simple">
<li><strong>reference_class</strong> &#8211; A db.Model class which will be used to generate the default query
to make the list of items. If this is not specified, The <cite>query</cite>
property must be overridden before validation.</li>
<li><strong>get_label</strong> &#8211; If a string, use this attribute on the model class as the label
associated with each option. If a one-argument callable, this callable
will be passed model instance and expected to return the label text.
Otherwise, the model object&#8217;s <cite>__str__</cite> or <cite>__unicode__</cite> will be used.</li>
<li><strong>allow_blank</strong> &#8211; If set to true, a blank choice will be added to the top of the list
to allow <cite>None</cite> to be chosen.</li>
<li><strong>blank_text</strong> &#8211; Use this to override the default blank option&#8217;s label.</li>
</ul>
</td>
</tr>
</tbody>
</table>
</dd></dl>

<span class="target" id="module-wtforms.ext.appengine.ndb"></span><dl class="function">
<dt id="wtforms.ext.appengine.ndb.model_form">
<tt class="descclassname">wtforms.ext.appengine.ndb.</tt><tt class="descname">model_form</tt><big>(</big><em>model</em>, <em>base_class=Form</em>, <em>only=None</em>, <em>exclude=None</em>, <em>field_args=None</em>, <em>converter=None</em><big>)</big><a class="headerlink" href="#wtforms.ext.appengine.ndb.model_form" title="Permalink to this definition">¶</a></dt>
<dd><p>Creates and returns a dynamic <tt class="docutils literal"><span class="pre">wtforms.Form</span></tt> class for a given
<tt class="docutils literal"><span class="pre">ndb.Model</span></tt> class. The form class can be used as it is or serve as a base
for extended form classes, which can then mix non-model related fields,
subforms with other model forms, among other possibilities.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><ul class="first last simple">
<li><strong>model</strong> &#8211; The <tt class="docutils literal"><span class="pre">ndb.Model</span></tt> class to generate a form for.</li>
<li><strong>base_class</strong> &#8211; Base form class to extend from. Must be a <tt class="docutils literal"><span class="pre">wtforms.Form</span></tt> subclass.</li>
<li><strong>only</strong> &#8211; An optional iterable with the property names that should be included in
the form. Only these properties will have fields.</li>
<li><strong>exclude</strong> &#8211; An optional iterable with the property names that should be excluded
from the form. All other properties will have fields.</li>
<li><strong>field_args</strong> &#8211; An optional dictionary of field names mapping to keyword arguments
used to construct each field object.</li>
<li><strong>converter</strong> &#8211; A converter to generate the fields based on the model properties. If
not set, <tt class="docutils literal"><span class="pre">ModelConverter</span></tt> is used.</li>
</ul>
</td>
</tr>
</tbody>
</table>
</dd></dl>

</div>
</div>
<div class="section" id="module-wtforms.ext.dateutil.fields">
<span id="dateutil"></span><h2>Dateutil<a class="headerlink" href="#module-wtforms.ext.dateutil.fields" title="Permalink to this headline">¶</a></h2>
<p>For better date-time parsing using the <a class="reference external" href="http://labix.org/python-dateutil">python-dateutil</a>  package,
<tt class="xref py py-mod docutils literal"><span class="pre">wtforms.ext.dateutil</span></tt> provides a set of fields to use to accept a wider
range of date input.</p>
<dl class="class">
<dt id="wtforms.ext.dateutil.fields.DateTimeField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.dateutil.fields.</tt><tt class="descname">DateTimeField</tt><big>(</big><em>default field arguments</em>, <em>parse_kwargs=None</em>, <em>display_format='%Y-%m-%d %H:%M'</em><big>)</big><a class="headerlink" href="#wtforms.ext.dateutil.fields.DateTimeField" title="Permalink to this definition">¶</a></dt>
<dd><p>DateTimeField represented by a text input, accepts all input text formats
that <cite>dateutil.parser.parse</cite> will.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><ul class="first last simple">
<li><strong>parse_kwargs</strong> &#8211; A dictionary of keyword args to pass to the dateutil parse() function.
See dateutil docs for available keywords.</li>
<li><strong>display_format</strong> &#8211; A format string to pass to strftime() to format dates for display.</li>
</ul>
</td>
</tr>
</tbody>
</table>
</dd></dl>

<dl class="class">
<dt id="wtforms.ext.dateutil.fields.DateField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.dateutil.fields.</tt><tt class="descname">DateField</tt><big>(</big><em>default field arguments</em>, <em>parse_kwargs=None</em>, <em>display_format='%Y-%m-%d'</em><big>)</big><a class="headerlink" href="#wtforms.ext.dateutil.fields.DateField" title="Permalink to this definition">¶</a></dt>
<dd><p>Same as the DateTimeField, but stores only the date portion.</p>
</dd></dl>

</div>
<div class="section" id="module-wtforms.ext.django">
<span id="django"></span><h2>Django<a class="headerlink" href="#module-wtforms.ext.django" title="Permalink to this headline">¶</a></h2>
<p>This extension provides templatetags to make it easier to work with Django
templates and WTForms&#8217; html attribute rendering. It also provides a generator
for automatically creating forms based on Django ORM models.</p>
<div class="section" id="module-wtforms.ext.django.templatetags.wtforms">
<span id="templatetags"></span><h3>Templatetags<a class="headerlink" href="#module-wtforms.ext.django.templatetags.wtforms" title="Permalink to this headline">¶</a></h3>
<p>Django templates does not allow arbitrarily calling functions with parameters,
making it impossible to use the html attribute rendering feature of WTForms. To
alleviate this, we provide a templatetag.</p>
<p>Adding <a class="reference internal" href="#module-wtforms.ext.django" title="wtforms.ext.django"><tt class="xref py py-mod docutils literal"><span class="pre">wtforms.ext.django</span></tt></a> to your INSTALLED_APPS will make the wtforms
template library available to your application.  With this you can pass extra
attributes to form fields similar to the usage in jinja:</p>
<div class="highlight-django"><div class="highlight"><pre><span class="cp">{%</span> <span class="k">load</span> <span class="nv">wtforms</span> <span class="cp">%}</span><span class="x"></span>

<span class="cp">{%</span> <span class="k">form_field</span> <span class="nv">form.username</span> <span class="nv">class</span><span class="o">=</span><span class="s2">&quot;big_text&quot;</span> <span class="nv">onclick</span><span class="o">=</span><span class="s2">&quot;do_something()&quot;</span> <span class="cp">%}</span><span class="x"></span>
</pre></div>
</div>
<p><strong>Note</strong> By default, using the <cite>{{ form.field }}</cite> syntax in django models will
be auto-escaped.  To avoid this happening, use Django&#8217;s <cite>{% autoescape off %}</cite>
block tag or use WTForms&#8217; <cite>form_field</cite> template tag.</p>
</div>
<div class="section" id="id2">
<h3>Model forms<a class="headerlink" href="#id2" title="Permalink to this headline">¶</a></h3>
<span class="target" id="module-wtforms.ext.django.orm"></span><dl class="function">
<dt id="wtforms.ext.django.orm.model_form">
<tt class="descclassname">wtforms.ext.django.orm.</tt><tt class="descname">model_form</tt><big>(</big><em>model</em>, <em>base_class=Form</em>, <em>only=None</em>, <em>exclude=None</em>, <em>field_args=None</em>, <em>converter=None</em><big>)</big><a class="headerlink" href="#wtforms.ext.django.orm.model_form" title="Permalink to this definition">¶</a></dt>
<dd><p>Create a wtforms Form for a given Django model class:</p>
<div class="highlight-python"><div class="highlight"><pre><span class="kn">from</span> <span class="nn">wtforms.ext.django.orm</span> <span class="kn">import</span> <span class="n">model_form</span>
<span class="kn">from</span> <span class="nn">myproject.myapp.models</span> <span class="kn">import</span> <span class="n">User</span>
<span class="n">UserForm</span> <span class="o">=</span> <span class="n">model_form</span><span class="p">(</span><span class="n">User</span><span class="p">)</span>
</pre></div>
</div>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><ul class="first last simple">
<li><strong>model</strong> &#8211; A Django ORM model class</li>
<li><strong>base_class</strong> &#8211; Base form class to extend from. Must be a <tt class="docutils literal"><span class="pre">wtforms.Form</span></tt> subclass.</li>
<li><strong>only</strong> &#8211; An optional iterable with the property names that should be included in
the form. Only these properties will have fields.</li>
<li><strong>exclude</strong> &#8211; An optional iterable with the property names that should be excluded
from the form. All other properties will have fields.</li>
<li><strong>field_args</strong> &#8211; An optional dictionary of field names mapping to keyword arguments used
to construct each field object.</li>
<li><strong>converter</strong> &#8211; A converter to generate the fields based on the model properties. If
not set, <tt class="docutils literal"><span class="pre">ModelConverter</span></tt> is used.</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p><a class="reference internal" href="#wtforms.ext.django.orm.model_form" title="wtforms.ext.django.orm.model_form"><tt class="xref py py-func docutils literal"><span class="pre">model_form()</span></tt></a> attempts to glean as much metadata as possible from
inspecting the model&#8217;s fields, and will even attempt to guess at what
validation might be wanted based on the field type. For example, converting
an <cite>EmailField</cite> will result in a <a class="reference internal" href="fields.html#wtforms.fields.TextField" title="wtforms.fields.TextField"><tt class="xref py py-class docutils literal"><span class="pre">TextField</span></tt></a> with
the <tt class="xref py py-func docutils literal"><span class="pre">email()</span></tt> validator on it. if the <cite>blank</cite>
property is set on a model field, the resulting form field will have the
<tt class="xref py py-func docutils literal"><span class="pre">optional()</span></tt> validator set.</p>
<p>Just like any other Form, forms created by ModelForm can be extended via
inheritance:</p>
<div class="highlight-python"><div class="highlight"><pre><span class="n">UserFormBase</span> <span class="o">=</span> <span class="n">model_form</span><span class="p">(</span><span class="n">User</span><span class="p">)</span>

<span class="k">class</span> <span class="nc">UserForm</span><span class="p">(</span><span class="n">UserFormBase</span><span class="p">):</span>
    <span class="n">new_pass</span>     <span class="o">=</span> <span class="n">PasswordField</span><span class="p">(</span><span class="s">&#39;&#39;</span><span class="p">,</span> <span class="p">[</span><span class="n">validators</span><span class="o">.</span><span class="n">optional</span><span class="p">(),</span> <span class="n">validators</span><span class="o">.</span><span class="n">equal_to</span><span class="p">(</span><span class="s">&#39;confirm_pass&#39;</span><span class="p">)])</span>
    <span class="n">confirm_pass</span> <span class="o">=</span> <span class="n">PasswordField</span><span class="p">()</span>
</pre></div>
</div>
<p>When combined with <a class="reference internal" href="forms.html#wtforms.form.Form.__iter__" title="wtforms.form.Form.__iter__"><tt class="xref py py-meth docutils literal"><span class="pre">form</span> <span class="pre">iteration</span></tt></a>,
model_form is a handy way to generate dynamic CRUD forms which update with
added fields to the model. One must be careful though, as it&#8217;s possible the
generated form fields won&#8217;t be as strict with validation as a hand-written
form might be.</p>
</dd></dl>

</div>
<div class="section" id="module-wtforms.ext.django.fields">
<span id="orm-backed-fields"></span><h3>ORM-backed fields<a class="headerlink" href="#module-wtforms.ext.django.fields" title="Permalink to this headline">¶</a></h3>
<p>While linking data to most fields is fairly easy, making drop-down select lists
using django ORM data can be quite repetitive. To this end, we have added some
helpful tools to use the django ORM along with wtforms.</p>
<dl class="class">
<dt id="wtforms.ext.django.fields.QuerySetSelectField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.django.fields.</tt><tt class="descname">QuerySetSelectField</tt><big>(</big><em>default field args</em>, <em>queryset=None</em>, <em>get_label=None</em>, <em>allow_blank=False</em>, <em>blank_text=u''</em><big>)</big><a class="headerlink" href="#wtforms.ext.django.fields.QuerySetSelectField" title="Permalink to this definition">¶</a></dt>
<dd><p>Given a QuerySet either at initialization or inside a view, will display a
select drop-down field of choices. The <cite>data</cite> property actually will
store/keep an ORM model instance, not the ID. Submitting a choice which is
not in the queryset will result in a validation error.</p>
<p>Specify <cite>get_label</cite> to customize the label associated with each option. If
a string, this is the name of an attribute on the model object to use as
the label text. If a one-argument callable, this callable will be passed
model instance and expected to return the label text. Otherwise, the model
object&#8217;s <cite>__str__</cite> or <cite>__unicode__</cite> will be used.</p>
<p>If <cite>allow_blank</cite> is set to <cite>True</cite>, then a blank choice will be added to the
top of the list. Selecting this choice will result in the <cite>data</cite> property
being <cite>None</cite>.  The label for the blank choice can be set by specifying the
<cite>blank_text</cite> parameter.</p>
<div class="highlight-python"><div class="highlight"><pre><span class="k">class</span> <span class="nc">ArticleEdit</span><span class="p">(</span><span class="n">Form</span><span class="p">):</span>
    <span class="n">title</span>    <span class="o">=</span> <span class="n">TextField</span><span class="p">()</span>
    <span class="n">column</span>   <span class="o">=</span> <span class="n">QuerySetSelectField</span><span class="p">(</span><span class="n">get_label</span><span class="o">=</span><span class="s">&#39;title&#39;</span><span class="p">,</span> <span class="n">allow_blank</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>
    <span class="n">category</span> <span class="o">=</span> <span class="n">QuerySetSelectField</span><span class="p">(</span><span class="n">queryset</span><span class="o">=</span><span class="n">Category</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">all</span><span class="p">())</span>

<span class="k">def</span> <span class="nf">edit_article</span><span class="p">(</span><span class="n">request</span><span class="p">,</span> <span class="nb">id</span><span class="p">):</span>
    <span class="n">article</span> <span class="o">=</span> <span class="n">Article</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">pk</span><span class="o">=</span><span class="nb">id</span><span class="p">)</span>
    <span class="n">form</span> <span class="o">=</span> <span class="n">ArticleEdit</span><span class="p">(</span><span class="n">obj</span><span class="o">=</span><span class="n">article</span><span class="p">)</span>
    <span class="n">form</span><span class="o">.</span><span class="n">column</span><span class="o">.</span><span class="n">queryset</span> <span class="o">=</span> <span class="n">Column</span><span class="o">.</span><span class="n">objects</span><span class="o">.</span><span class="n">filter</span><span class="p">(</span><span class="n">author</span><span class="o">=</span><span class="n">request</span><span class="o">.</span><span class="n">user</span><span class="p">)</span>
</pre></div>
</div>
<p>As shown in the above example, the queryset can be set dynamically in the
view if needed instead of at form construction time, allowing the select
field to consist of choices only relevant to the user.</p>
</dd></dl>

<dl class="class">
<dt id="wtforms.ext.django.fields.ModelSelectField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.django.fields.</tt><tt class="descname">ModelSelectField</tt><big>(</big><em>default field args</em>, <em>model=None</em>, <em>get_label=''</em>, <em>allow_blank=False</em>, <em>blank_text=u''</em><big>)</big><a class="headerlink" href="#wtforms.ext.django.fields.ModelSelectField" title="Permalink to this definition">¶</a></dt>
<dd><p>Like a QuerySetSelectField, except takes a model class instead of a
queryset and lists everything in it.</p>
</dd></dl>

</div>
</div>
<div class="section" id="module-wtforms.ext.sqlalchemy">
<span id="sqlalchemy"></span><h2>SQLAlchemy<a class="headerlink" href="#module-wtforms.ext.sqlalchemy" title="Permalink to this headline">¶</a></h2>
<p>This extension provides SelectField integration with SQLAlchemy ORM models,
similar to those in the Django extension.</p>
<div class="section" id="id3">
<h3>ORM-backed fields<a class="headerlink" href="#id3" title="Permalink to this headline">¶</a></h3>
<span class="target" id="module-wtforms.ext.sqlalchemy.fields"></span><p>These fields are provided to make it easier to use data from ORM objects in
your forms.</p>
<div class="highlight-python"><div class="highlight"><pre><span class="k">def</span> <span class="nf">enabled_categories</span><span class="p">():</span>
    <span class="k">return</span> <span class="n">Category</span><span class="o">.</span><span class="n">query</span><span class="o">.</span><span class="n">filter_by</span><span class="p">(</span><span class="n">enabled</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>

<span class="k">class</span> <span class="nc">BlogPostEdit</span><span class="p">(</span><span class="n">Form</span><span class="p">):</span>
    <span class="n">title</span>    <span class="o">=</span> <span class="n">TextField</span><span class="p">()</span>
    <span class="n">blog</span>     <span class="o">=</span> <span class="n">QuerySelectField</span><span class="p">(</span><span class="n">get_label</span><span class="o">=</span><span class="s">&#39;title&#39;</span><span class="p">)</span>
    <span class="n">category</span> <span class="o">=</span> <span class="n">QuerySelectField</span><span class="p">(</span><span class="n">query_factory</span><span class="o">=</span><span class="n">enabled_categories</span><span class="p">,</span> <span class="n">allow_blank</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>

<span class="k">def</span> <span class="nf">edit_blog_post</span><span class="p">(</span><span class="n">request</span><span class="p">,</span> <span class="nb">id</span><span class="p">):</span>
    <span class="n">post</span> <span class="o">=</span> <span class="n">Post</span><span class="o">.</span><span class="n">query</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="nb">id</span><span class="p">)</span>
    <span class="n">form</span> <span class="o">=</span> <span class="n">ArticleEdit</span><span class="p">(</span><span class="n">obj</span><span class="o">=</span><span class="n">post</span><span class="p">)</span>
    <span class="c"># Since we didn&#39;t provide a query_factory for the &#39;blog&#39; field, we need</span>
    <span class="c"># to set a dynamic one in the view.</span>
    <span class="n">form</span><span class="o">.</span><span class="n">blog</span><span class="o">.</span><span class="n">query</span> <span class="o">=</span> <span class="n">Blog</span><span class="o">.</span><span class="n">query</span><span class="o">.</span><span class="n">filter</span><span class="p">(</span><span class="n">Blog</span><span class="o">.</span><span class="n">author</span> <span class="o">==</span> <span class="n">request</span><span class="o">.</span><span class="n">user</span><span class="p">)</span><span class="o">.</span><span class="n">order_by</span><span class="p">(</span><span class="n">Blog</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
</pre></div>
</div>
<dl class="class">
<dt id="wtforms.ext.sqlalchemy.fields.QuerySelectField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.sqlalchemy.fields.</tt><tt class="descname">QuerySelectField</tt><big>(</big><em>default field args</em>, <em>query_factory=None</em>, <em>get_pk=None</em>, <em>get_label=None</em>, <em>allow_blank=False</em>, <em>blank_text=u''</em><big>)</big><a class="headerlink" href="#wtforms.ext.sqlalchemy.fields.QuerySelectField" title="Permalink to this definition">¶</a></dt>
<dd><p>Will display a select drop-down field to choose between ORM results in a
sqlalchemy <cite>Query</cite>.  The <cite>data</cite> property actually will store/keep an ORM
model instance, not the ID. Submitting a choice which is not in the query
will result in a validation error.</p>
<p>This field only works for queries on models whose primary key column(s)
have a consistent string representation. This means it mostly only works
for those composed of string, unicode, and integer types. For the most
part, the primary keys will be auto-detected from the model, alternately
pass a one-argument callable to <cite>get_pk</cite> which can return a unique
comparable key.</p>
<p>The <cite>query</cite> property on the field can be set from within a view to assign
a query per-instance to the field. If the property is not set, the
<cite>query_factory</cite> callable passed to the field constructor will be called to
obtain a query.</p>
<p>Specify <cite>get_label</cite> to customize the label associated with each option. If
a string, this is the name of an attribute on the model object to use as
the label text. If a one-argument callable, this callable will be passed
model instance and expected to return the label text. Otherwise, the model
object&#8217;s <cite>__str__</cite> or <cite>__unicode__</cite> will be used.</p>
<p>If <cite>allow_blank</cite> is set to <cite>True</cite>, then a blank choice will be added to the
top of the list. Selecting this choice will result in the <cite>data</cite> property
being <cite>None</cite>. The label for this blank choice can be set by specifying the
<cite>blank_text</cite> parameter.</p>
</dd></dl>

<dl class="class">
<dt id="wtforms.ext.sqlalchemy.fields.QuerySelectMultipleField">
<em class="property">class </em><tt class="descclassname">wtforms.ext.sqlalchemy.fields.</tt><tt class="descname">QuerySelectMultipleField</tt><big>(</big><em>default field args</em>, <em>query_factory=None</em>, <em>get_pk=None</em>, <em>get_label=None</em>, <em>allow_blank=False</em>, <em>blank_text=u''</em><big>)</big><a class="headerlink" href="#wtforms.ext.sqlalchemy.fields.QuerySelectMultipleField" title="Permalink to this definition">¶</a></dt>
<dd><p>Very similar to QuerySelectField with the difference that this will
display a multiple select. The data property will hold a list with ORM
model instances and will be an empty list when no value is selected.</p>
<p>If any of the items in the data list or submitted form data cannot be
found in the query, this will result in a validation error.</p>
</dd></dl>

</div>
</div>
<div class="section" id="module-wtforms.ext.csrf">
<span id="csrf"></span><h2>CSRF<a class="headerlink" href="#module-wtforms.ext.csrf" title="Permalink to this headline">¶</a></h2>
<p>The CSRF package includes tools that help you implement checking against
cross-site request forgery (&#8220;csrf&#8221;). Due to the large number of variations on
approaches people take to CSRF (and the fact that many make compromises) the
base implementation allows you to plug in a number of CSRF validation
approaches.</p>
<p>CSRF implementations are made by subclassing
<a class="reference internal" href="#wtforms.ext.csrf.form.SecureForm" title="wtforms.ext.csrf.form.SecureForm"><tt class="xref py py-class docutils literal"><span class="pre">SecureForm</span></tt></a>. For utility, we have provided one
possible CSRF implementation in the package that can be used with many
frameworks for session-based hash secure keying,
<a class="reference internal" href="#wtforms.ext.csrf.session.SessionSecureForm" title="wtforms.ext.csrf.session.SessionSecureForm"><tt class="xref py py-class docutils literal"><span class="pre">SessionSecureForm</span></tt></a>.</p>
<p>All CSRF implementations hinge around creating a special token, which is put in
a hidden field on the form named &#8216;csrf_token&#8217;, which must be rendered in your
template to be passed from the browser back to your view. There are many
different methods of generating this token, but they are usually the result of
a cryptographic hash function against some data which would be hard to forge.</p>
<span class="target" id="module-wtforms.ext.csrf.form"></span><dl class="class">
<dt id="wtforms.ext.csrf.form.SecureForm">
<em class="property">class </em><tt class="descclassname">wtforms.ext.csrf.form.</tt><tt class="descname">SecureForm</tt><big>(</big><em>formdata=None</em>, <em>obj=None</em>, <em>prefix=u''</em>, <em>csrf_context=None</em>, <em>**kwargs</em><big>)</big><a class="headerlink" href="#wtforms.ext.csrf.form.SecureForm" title="Permalink to this definition">¶</a></dt>
<dd><p>Form that enables CSRF processing via subclassing hooks.</p>
<dl class="method">
<dt id="wtforms.ext.csrf.form.SecureForm.generate_csrf_token">
<tt class="descname">generate_csrf_token</tt><big>(</big><em>csrf_context</em><big>)</big><a class="headerlink" href="#wtforms.ext.csrf.form.SecureForm.generate_csrf_token" title="Permalink to this definition">¶</a></dt>
<dd><p>Implementations must override this to provide a method with which one
can get a CSRF token for this form.</p>
<p>A CSRF token should be a string which can be generated
deterministically so that on the form POST, the generated string is
(usually) the same assuming the user is using the site normally.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>csrf_context</strong> &#8211; A transparent object which can be used as contextual info for
generating the token.</td>
</tr>
</tbody>
</table>
</dd></dl>

<dl class="method">
<dt id="wtforms.ext.csrf.form.SecureForm.validate_csrf_token">
<tt class="descname">validate_csrf_token</tt><big>(</big><em>field</em><big>)</big><a class="headerlink" href="#wtforms.ext.csrf.form.SecureForm.validate_csrf_token" title="Permalink to this definition">¶</a></dt>
<dd><p>Override this method to provide custom CSRF validation logic.</p>
<p>The default CSRF validation logic simply checks if the recently
generated token equals the one we received as formdata.</p>
</dd></dl>

</dd></dl>

<div class="section" id="creating-your-own-csrf-implementation">
<h3>Creating your own CSRF implementation<a class="headerlink" href="#creating-your-own-csrf-implementation" title="Permalink to this headline">¶</a></h3>
<p>Here we will sketch out a simple theoretical CSRF implementation which
generates a hash token based on the user&#8217;s IP.</p>
<p><strong>Note</strong> This is a simplistic example meant to illustrate creating a CSRF
implementation. This isn&#8217;t recommended to be used in production because the
token is deterministic and non-changing per-IP, which means this isn&#8217;t the
most secure implementation of CSRF.</p>
<p>First, let&#8217;s create our SecureForm base class:</p>
<div class="highlight-python"><div class="highlight"><pre><span class="kn">from</span> <span class="nn">wtforms.ext.csrf</span> <span class="kn">import</span> <span class="n">SecureForm</span>
<span class="kn">from</span> <span class="nn">hashlib</span> <span class="kn">import</span> <span class="n">md5</span>

<span class="n">SECRET_KEY</span> <span class="o">=</span> <span class="s">&#39;1234567890&#39;</span>

<span class="k">class</span> <span class="nc">IPSecureForm</span><span class="p">(</span><span class="n">SecureForm</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">    Generate a CSRF token based on the user&#39;s IP. I am probably not very</span>
<span class="sd">    secure, so don&#39;t use me.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="k">def</span> <span class="nf">generate_csrf_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">csrf_context</span><span class="p">):</span>
        <span class="c"># csrf_context is passed transparently from the form constructor,</span>
        <span class="c"># in this case it&#39;s the IP address of the user</span>
        <span class="n">token</span> <span class="o">=</span> <span class="n">md5</span><span class="p">(</span><span class="n">SECRET_KEY</span> <span class="o">+</span> <span class="n">csrf_context</span><span class="p">)</span><span class="o">.</span><span class="n">hexdigest</span><span class="p">()</span>
        <span class="k">return</span> <span class="n">token</span>

    <span class="k">def</span> <span class="nf">validate_csrf_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">field</span><span class="p">):</span>
        <span class="k">if</span> <span class="n">field</span><span class="o">.</span><span class="n">data</span> <span class="o">!=</span> <span class="n">field</span><span class="o">.</span><span class="n">current_token</span><span class="p">:</span>
            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s">&#39;Invalid CSRF&#39;</span><span class="p">)</span>
</pre></div>
</div>
<p>Now that we have this taken care of, let&#8217;s write a simple form and view which would implement this:</p>
<div class="highlight-python"><div class="highlight"><pre><span class="k">class</span> <span class="nc">RegistrationForm</span><span class="p">(</span><span class="n">IPSecureForm</span><span class="p">):</span>
    <span class="n">name</span> <span class="o">=</span> <span class="n">TextField</span><span class="p">(</span><span class="s">&#39;Your Name&#39;</span><span class="p">)</span>
    <span class="n">email</span> <span class="o">=</span> <span class="n">TextField</span><span class="p">(</span><span class="s">&#39;Email&#39;</span><span class="p">,</span> <span class="p">[</span><span class="n">validators</span><span class="o">.</span><span class="n">email</span><span class="p">()])</span>

<span class="k">def</span> <span class="nf">register</span><span class="p">(</span><span class="n">request</span><span class="p">):</span>
    <span class="n">form</span> <span class="o">=</span> <span class="n">RegistrationForm</span><span class="p">(</span><span class="n">request</span><span class="o">.</span><span class="n">POST</span><span class="p">,</span> <span class="n">csrf_context</span><span class="o">=</span><span class="n">request</span><span class="o">.</span><span class="n">ip</span><span class="p">)</span>

    <span class="k">if</span> <span class="n">request</span><span class="o">.</span><span class="n">method</span> <span class="o">==</span> <span class="s">&#39;POST&#39;</span> <span class="ow">and</span> <span class="n">form</span><span class="o">.</span><span class="n">validate</span><span class="p">():</span>
        <span class="k">pass</span> <span class="c"># We&#39;re all good, create a user or whatever it is you do</span>
    <span class="k">elif</span> <span class="n">form</span><span class="o">.</span><span class="n">csrf_token</span><span class="o">.</span><span class="n">errors</span><span class="p">:</span>
        <span class="k">pass</span> <span class="c"># If we&#39;re here we suspect the user of cross-site request forgery</span>
    <span class="k">else</span><span class="p">:</span>
        <span class="k">pass</span> <span class="c"># Any other errors</span>

    <span class="k">return</span> <span class="n">render</span><span class="p">(</span><span class="s">&#39;register.html&#39;</span><span class="p">,</span> <span class="n">form</span><span class="o">=</span><span class="n">form</span><span class="p">)</span>
</pre></div>
</div>
<p>And finally, a simple template:</p>
<div class="highlight-html+jinja"><div class="highlight"><pre><span class="nt">&lt;form</span> <span class="na">action=</span><span class="s">&quot;register&quot;</span> <span class="na">method=</span><span class="s">&quot;POST&quot;</span><span class="nt">&gt;</span>
    <span class="cp">{{</span> <span class="nv">form.csrf_token</span> <span class="cp">}}</span>
    <span class="nt">&lt;p&gt;</span><span class="cp">{{</span> <span class="nv">form.name.label</span> <span class="cp">}}</span>: <span class="cp">{{</span> <span class="nv">form.name</span> <span class="cp">}}</span><span class="nt">&lt;/p&gt;</span>
    <span class="nt">&lt;p&gt;</span><span class="cp">{{</span> <span class="nv">form.email.label</span> <span class="cp">}}</span>: <span class="cp">{{</span> <span class="nv">form.email</span> <span class="cp">}}</span><span class="nt">&lt;/p&gt;</span>
    <span class="nt">&lt;input</span> <span class="na">type=</span><span class="s">&quot;submit&quot;</span> <span class="na">value=</span><span class="s">&quot;Register&quot;</span><span class="nt">&gt;</span>
<span class="nt">&lt;/form&gt;</span>
</pre></div>
</div>
<p>Please note that implementing CSRF detection is not fool-proof, and even with
the best CSRF protection implementation, it&#8217;s possible for requests to be
forged by expert attackers. However, a good CSRF protection would make it
infeasible for someone from an external site to hijack a form submission from
another user and perform actions as them without additional a priori knowledge.</p>
<p>In addition, it&#8217;s important to understand that very often, the more strict the
CSRF protection, the higher the chance of false positives occurring (ie,
legitimate users getting blocked by your CSRF protection) and choosing a CSRF
implementation is actually a matter of compromise. We will attempt to provide a
handful of usable reference algorithms built in to this library in the future, to
allow that choice to be easy.</p>
<p>Some tips on criteria people often examine when evaluating CSRF implementations:</p>
<blockquote>
<div><ul class="simple">
<li><strong>Reproducability</strong> If a token is based on attributes about the user, it
gains the advantage that one does not need secondary storage in which to
store the value between requests. However, if the same attributes can be
reproduced by an attacker, then the attacker can potentially forge this
information.</li>
<li><strong>Reusability</strong>. It might be desired to make a completely different token
every use, and disallow users from re-using past tokens. This is an
extremely powerful protection, but can have consequences on if the user uses
the back button (or in some cases runs forms simultaneously in multiple
browser tabs) and submits an old token, or otherwise. A possible compromise
is to allow reusability in a time window (more on that later).</li>
<li><strong>Time Ranges</strong> Many CSRF approaches use time-based expiry to make sure that
a token cannot be (re)used beyond a certain point. Care must be taken in
choosing the time criteria for this to not lock out legitimate users. For
example, if a user might walk away while filling out a long-ish form, or to
go look for their credit card, the time for expiry should take that into
consideration to provide a balance between security and limiting user
inconvenience.</li>
<li><strong>Requirements</strong> Some CSRF-prevention methods require the use of browser
cookies, and some even require client-side scripting support. The webmaster
implementing the CSRF needs to consider that such requirements (though
effective) may lock certain legitimate users out, and make this
determination whether it is a good idea to use. For example, for a site
already using cookies for login, adding another for CSRF isn&#8217;t as big of a
deal, but for other sites it may not be feasible.</li>
</ul>
</div></blockquote>
</div>
<div class="section" id="module-wtforms.ext.csrf.session">
<span id="session-based-csrf-implementation"></span><h3>Session-based CSRF implementation<a class="headerlink" href="#module-wtforms.ext.csrf.session" title="Permalink to this headline">¶</a></h3>
<p>A provided CSRF implementation which puts CSRF data in a session.</p>
<p>This can be used fairly comfortably with many <cite>request.session</cite> type
objects, including the Werkzeug/Flask session store, Django sessions, and
potentially other similar objects which use a dict-like API for storing
session keys.</p>
<p>The basic concept is a randomly generated value is stored in the user&#8217;s
session, and an hmac-sha1 of it (along with an optional expiration time,
for extra security) is used as the value of the csrf_token. If this token
validates with the hmac of the random value + expiration time, and the
expiration time is not passed, the CSRF validation will pass.</p>
<p><strong>Usage</strong></p>
<p>First, create a SessionSecureForm subclass that you can use as your base class
for any forms you want CSRF support for:</p>
<div class="highlight-python"><div class="highlight"><pre><span class="kn">from</span> <span class="nn">wtforms.ext.csrf.session</span> <span class="kn">import</span> <span class="n">SessionSecureForm</span>

<span class="k">class</span> <span class="nc">MyBaseForm</span><span class="p">(</span><span class="n">SessionSecureForm</span><span class="p">):</span>
    <span class="n">SECRET_KEY</span> <span class="o">=</span> <span class="s">&#39;EPj00jpfj8Gx1SjnyLxwBBSQfnQ9DJYe0Ym&#39;</span>
    <span class="n">TIME_LIMIT</span> <span class="o">=</span> <span class="n">timedelta</span><span class="p">(</span><span class="n">minutes</span><span class="o">=</span><span class="mi">20</span><span class="p">)</span>
</pre></div>
</div>
<p>Now incorporate it into any form/view by further subclassing:</p>
<div class="highlight-python"><div class="highlight"><pre><span class="k">class</span> <span class="nc">Registration</span><span class="p">(</span><span class="n">MyBaseForm</span><span class="p">):</span>
    <span class="n">name</span> <span class="o">=</span> <span class="n">TextField</span><span class="p">()</span>

<span class="k">def</span> <span class="nf">view</span><span class="p">(</span><span class="n">request</span><span class="p">):</span>
    <span class="n">form</span> <span class="o">=</span> <span class="n">Registration</span><span class="p">(</span><span class="n">request</span><span class="o">.</span><span class="n">POST</span><span class="p">,</span> <span class="n">csrf_context</span><span class="o">=</span><span class="n">request</span><span class="o">.</span><span class="n">session</span><span class="p">)</span>
    <span class="c"># rest of view here</span>
</pre></div>
</div>
<p>Note that request.session is passed as the <tt class="docutils literal"><span class="pre">csrf_context=</span></tt> parameter, this is
so that the CSRF token can be stored in your session for comparison on a later
request.</p>
<dl class="class">
<dt id="wtforms.ext.csrf.session.SessionSecureForm">
<em class="property">class </em><tt class="descclassname">wtforms.ext.csrf.session.</tt><tt class="descname">SessionSecureForm</tt><big>(</big><em>formdata=None</em>, <em>obj=None</em>, <em>prefix=u''</em>, <em>csrf_context=None</em>, <em>**kwargs</em><big>)</big><a class="headerlink" href="#wtforms.ext.csrf.session.SessionSecureForm" title="Permalink to this definition">¶</a></dt>
<dd><p>A provided CSRF implementation which puts CSRF data in a session. Must be
subclassed to be used.</p>
<p><strong>Class Attributes</strong></p>
<dl class="attribute">
<dt id="wtforms.ext.csrf.session.SessionSecureForm.SECRET_KEY">
<tt class="descname">SECRET_KEY</tt><a class="headerlink" href="#wtforms.ext.csrf.session.SessionSecureForm.SECRET_KEY" title="Permalink to this definition">¶</a></dt>
<dd><p>Must be set by subclasses to a random byte string that will be used to generate HMAC digests.</p>
</dd></dl>

<dl class="attribute">
<dt id="wtforms.ext.csrf.session.SessionSecureForm.TIME_LIMIT">
<tt class="descname">TIME_LIMIT</tt><a class="headerlink" href="#wtforms.ext.csrf.session.SessionSecureForm.TIME_LIMIT" title="Permalink to this definition">¶</a></dt>
<dd><p>If None, CSRF tokens never expire. If set to a <tt class="docutils literal"><span class="pre">datetime.timedelta</span></tt>,
this is how long til a generated token expires. Defaults to
<tt class="docutils literal"><span class="pre">timedelta(minutes=30)</span></tt></p>
</dd></dl>

</dd></dl>

</div>
</div>
</div>


        <div style="clear: both"></div>
      </div>
      <div id="footer">
        © Copyright 2010 by the <a href="http://wtforms.simplecodes.com">WTForms Team</a>,
        documentation generated by <a href="http://sphinx.pocoo.org/">Sphinx</a>
      </div>
    </div>
  </body>
</html>